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File No. Q-11013/6/2015-eGov 
* FTS: 3035352 


| Subject: Drafting of Legisiation on Electronic Health Data privacy, 


| confidentiality and security- reg 


This relates to the drafting of legislation on Electronic Health Data 

privacy, confidentiality and security. Two meetings of Legal Sub Group 
| had been held on 13" January, 2015 and 15" April 2015 under the 
Chairmanship of AS&DG ({CGHS) to discuss the Health Data Privacy and 


Security in India. 


2. in the Second meeting of Legal Sub Group, it was decided to 
request the selected institutes of repute having requisite domain 
expertise, for the expression of interest (EOI) for drafting of the proposed 


Act. in this regard following four institutes were identified: 


e |IT- Kharagpur 
¢ National Law School of India University- Bangalore 
e indian Law Institute- New Dethi 


¢ National Academy of Lega! Studies and Research- Hyderabad 


3. Ministry has received EO! from all the Four Institutes and a 
meeting of Legal Sub-group under EMR/EHR Standards Committee was 
held under the chairmanship of Shri K.B. Agarwal, AS(eGov.), MoHFW 
on 14th October, 2015 to review the EOls received from the identified 
legal institutes for drafting the proposed legislation for Electronic Health 


Data Privacy & Security. 


4. in the meeting, it was decided to invite four institutes to MoHFW 
for presentation exhibiting their understanding of the scope of work, 
proposed approach & methodology, previous project experiente, resource 
strength etc. before the Legal Sub-group. 


| a Another meeting of Legal Sub-group under EMR/EHR Standards 
Committee was held under the chairmanship of Shri K.B. Agarwal, AS 
(eGov.), MoHFW on 1° December, 2015 to evaluate the presentations 


. made by the identified jegal institutes for drafting the proposed legisiation. 
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6. As per the decisions taken in the meeting (p.376/C), NALSAR 
University of Law, Hyderabad and Nationa! Law School of India 
University, Bangalore were shortlisted for inviting financial quotes and 


were asked to submit financial quotes by 18.01.2015. (P 382-383/C). 


7. Financial quotes from both the legal institutes have been received 
by the Ministry. NALSAR University of Law, Hyderabad has proposed 
financial quote to the tune of Rs. SSV@B@OWEF placed at ‘F/A’) and 
financial quotes submitted by National Law School of india University, 


Bangalore are MERRIE placed at ‘F/B’. 


8. Since the financial quotes from both the institutes have been 


received file is submitted for further decisions/ directions please. 
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integrated Finance Division 


This is regarding drafting of Legisiation on Electronic Health Data privacy, 
confidentiality and security 


FTS No.3035352 


| 2. The Division has stated that in the second meeting of Legal Sub Group, it was 
decided to request the selected institutes of repute having requisite domain expertise for 
the Expression of Interest (Eol) for drafting of the proposed Act. In this regard, four 
ad Institutes have been identified (refer p.41/n) 


PO 3 The Ministry has received Eol from all the four institutes. The said institutes were 
nvited by the Ministry for presentation exhibiting their understanding of the scope of work. 
proposed approach & methodology, previous project experience, resource strength etc. 
After evaluating the presentation, two Institutes viz. NALSAR University of Law, 
Hyderabad and National Law School of India University, Bangalore were shortlisted for 

_ Inviting financial quotes. 


4. Financial quotes have been received from these two institutes. NALSAR University 
of Law, Hyderabad proposed financial quote of Rs.51,38,200/- (F/A) and financial quote of 
National Law School of India University, Bangalore is Rs.27,00,000/- (F/B). The Division 
las sought concurrence of IFD for awarding the working of drafting of Legislation on 
lectronic Health Data privacy, confidentiality and security to National Law School of India 
University, Bangaiore for Rs.27,00,000/- 
| 
~—~é68. In this regard, it may be observed that as per GFR 151. Limited Tender Enquiry 
may be adopted when the estimated value of the goods to be procured is upto Rs.25.00 
| lakh. However, purchase through Limited Tender Enquiry may be adopted even where the 
| estimated value of procurement is more than Rs.25.00 lakh in certain circumsta nces, as 
| elaborated in the extracts of GFRatF/X ==——S—S—s—“‘“—*~S*S*S*S*S*S*S*S*SSSSSOO 


6. The Division may be advised to examine the proposai in the light of GFR 151 and 
ensure that the proposal is in accordance with GER provisions under reference. 
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FTS No.3035352 


Integrated Finance Division } 


| | This is regarding drafting of Legislation on Electronic Health Data privacy, 
confidentiality and security 


2. IFD examined the case vide p.43/n and sought certain clarifications. The Division 
has now furnished the requisite clarifications vide p.43-44/n. 


3. In this connection, it may be recailed that in the second meeting of Legai Sub Group. 
it was decided to request the selected institutes of repute having requisite domain expertise 
for the Expression of Interest (Eol) for drafting of the proposed Act. in this regard, four 
Institutes have been identified (refer p.41/n), 


So The Ministry has received Eol from all the four Institutes. The said institutes were 
invited by the Ministry for presentation exhibiting their understanding of the scope of work. 
proposed approach & methodology, previous project experience, resource strength etc. 
After evaluating the presentation, two institutes viz. NALSAR University of Law, Hyderabad 
and National Law School of India University, Bangalore were shortlisted for inviting financial 
quotes 


1) 6. In the third meeting of the Legal Sub Group, only two Institutes were shortlisted, after 
_ the detailed presentation given by the four Institutes (p.376/c). As regards shortlisting of two 
Institutes, it has been clanfied that these two Institutes are reputed and have been involved 
by other Departments/Ministries for framing the similar nature of work. 


6. It has been stated that MoU with selected institutes will be signed for proceeding any 
payment for rendering services and the progress will be monitored by Legal Sub Group. 


7, Financial quotes have been now received from these two Institutes. NALSAR 
University of Law, Hyderabad proposed financial quote of Rs. 51,38,200/- (F/A) and financial 
quote of National Law School of India University, Bangalore is Rs.27,00,000/- (F/B). The 
Division has sought concurrence of IFD for awarding the work of drafting of Legisiation on 
Electronic Health Data privacy, confidentiality and security to National Law School of India 
University, Bangalore for Rs.27,00,000/- (B). 


a 


8 It is also mentioned that the quoted price is mainly for man months involved for 
drafting the proposal legisiation for EHR data privacy & security and institute charges. The 
| ision has also stated that in the Senior Officers’ Meeting on 31.12.2015, the matter was 
4 discussed and as per the Minutes of the meeting, the work is to be taken up on top priority 
LD ‘| and to be completed by June 2016 (F/X). 


wy, :| @ In view of the facts and circumstances explained by the Division, IFD may concur in 
a the proposal of the Division for awarding the work of drafting of Legisiation on Electronic 
iM AL alth, Data privacy, confidentiality and security to National Law Schoo! of India aes 
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FTS: 3035352 


Subject: Drafting of Legisiation on Eiectronic Health Data privacy, confidentiality and 
Me security- reg 
| 
This relates to the drafting of legislation on Electronic Health Data/| privacy, 
| confidentiality and security. Two meetings of Legal Sub Group had been held on 13" January, 
2015 and 15" Apri! 2015 under the Chairmanship of AS&DG {CGHS) to discuss the Health Data 
Privacy and Security in India. 





2. in the Second meeting of Legal Sub Group, it was decided to request the selected 
institutes of repute having requisite domain expertise, for the expression of interest (EO!) for 
drafting of the proposed Act. In this regard following four institutes were identified: 


e liT- Kharagpur 

e National Law School of india University- Bangalore 

e indian Law institute- New Deihi 

e National Academy of Legal Studies and Research- Hyderabad 


3. The Ministry has received Eol from all the four Institutes. The said Institutes were 
invited by the Ministry for presentation exhibiting their understanding of the scope!of work, 
proposed approach & methodology, previous project experience, resource strength etc. After 
evaluating the presentation, two Institutes viz., NALSAR University of Law, Hyderabad and 
National Law Schoo! of India University, Bangalore were shortlisted for inviting | financial 
quotes. (P-376/C) | 





| 4. Financial quotes from both the legal institutes have been received by the |Ministry. 
NALSAR University of Law, Hyderabad nas proposed financial quote to the tune of Rs. 
51,38,200/- (placed at ‘F/A’) and financial quotes submitted by National Law Schoai of India 
University, Bangalore are Rs. 27,00,000/- (piaced at ‘F/B’}. ’ 


a t# if 5. The concurrence of IFD has been received for awarding the work of drafting of 

: fa 1" Legislation on Eiectronic Health Data privacy, confidentiality and security to National Law 
/ at School of India University, Bangalore for Rs.27,00,000/-. | 
a, | 

6. File is submitted for approval of Secretary (HFW) for awarding the work of drafting of 


Legislation on Electronic Health Data privacy, confidentiality and security to National Law 
School of India University, Bangalore. : 
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File No.Q-11013/6/2015-eGov 
FTS No: 81876 


Subject: Approval of Draft Act for setting up of “National Digital Health 
Authority of India (NDHAI)” -reg 


This is regarding the Draft Act prepared by Ministry of Health & Family 
Welfare (MoHFW) for setting up of “National Digital Health Authority of India 
(NDHAI)”. 


. In order to address the needs identified & delineated for standards, 
regulation, data privacy & security etc. in Indian eHealth ecosystem so as to 
achieve an orderly development and to gain effective & efficient results thereof, 
MoHFW decided to set up a nodal body in form of an “Authority” through an Act 
of parliament. Accordingly, a concept note in this regard was drafted by the 
Legal Sub-group under EHR Standards Committee of MoHFW and was 
consulted thoroughly with different stakeholders. Thereafter with approval of 
Hon'ble HFM, the concept note was put in public domain for soliciting 
suggestions/comments from general public. A national level consultation was 
also held on 4" April 2016 to discuss the concept note and thereafter it was 
finalised for further perusal. 


3: Further, for drafting the Act for setting up the envisaged Authority, 
MoHFW mandated the task to National Law School of India University (NLSIU), 
Bengaluru in Feb, 2016. The draft Act for setting up the Authority by name 
“National Digital Health Authority of India (NDHAI)” has now been finalised after 
a number of rounds of discussions & deliberations with various stakeholders 
over the past few months. The stakeholders consulted for this purpose were 
drawn from divergent groups such as health service provider, medical 
professional, health informatics professional, industry association, legal experts 
etc. and other Ministries/Departments/Organisations such MeitY, UIDAI etc. 


4 The key sections of the draft Act are regarding: 


- Confidentiality, privacy, ownership of health data 
o Rights to health data owner (i.e. Patient) 
o Norms to be followed by health services providers/heath 
information exchanges in regard to data privacy & security 
- Establishment of National Digital Health Authority of India, its roles 
& power 
- Recognition of Health Information Exchanges (HIEs) by NDHAI 
- Operational guidelines and mandatory key manning for HIEs 
- Issue of standardization, storage & transmission of data 
- Nature of punishment (civil or criminal) etc., for data breach 
- Setting up of Adjudicating Authority(ies) 
o To penalise for data privacy & security breach 
- Setting up of Appellate Tribunal 


A brief note highlighting salient features of the Draft Act is placed at F/A. 


5. It may also be noted that the National Health Policy (NHP) 2017 (copy 
enclosed at F/B) having recognised the integral role of technology (eHealth, 
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also outlines setting up a National Digital Health Authority (NDHA) to regulate. 

develop and deploy digital health across the continuum of care. The Policy aims ° 

at an integrated health information system which serves the needs of all stake- 

holders and improves efficiency, transparency, and citizen experience. 

Therefore significance and role of NDHA emerges quite imperative and critical 

for overall development of Indian eHealth ecosystem in an orderly manner. 


6. Now, as decided in the meeting held on 24" March 2017 under the 
chairmanship of AS&DG(CGHS) ( Minutes of meeting at F/C), it is proposed to 
put the Draft Act in public domain for a period of atleast one month for soliciting 
suggestions/comments from general public. Thereafter the 
suggestions/comments received ‘would be analysed and = appropriately 
addressed through modifications, as required, in the Draft Act. Further the work 
for preparation of Bill in coordination with Ministry of Law will be undertaken. 


fr Accordingly, approval of Hon'ble HFM is solicited for putting the “Draft 
Act for setting up of NDHAI” in public domain. 


Submitted for approval of Hon'ble HFM please. 


ben 
(uitondra Alera? 1 


Director (eHealth) 
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FTS No: 3105692 


Subject: Approval of Draft Act for setting up of “National Digital Health 
Authority of India (NDHAI)” -reg 


This is regarding the Draft Act prepared by Ministry of Health & Family 
Welfare (MoHFW) for setting up of “National Digital Health Authority of India 
(NDHAI)”. 


2. In Health Sector, both public and private sectors, a number of Health 
Information Systems have currently been implemented which collect and collate 
| health/clinical data of patients/citizens on a large and diversified scale. As a result huge 
health/clinical data repositories are being created and made use of. More number of 
such health information systems continue to be developed and implemented adding to 
the volume of health data repositories on a continuous basis. Also the 
| use/transfer/transactions of health data, especially in electronic format, is continually 
increasing. Under such a scenario, privacy, confidentiality and security of health 

data/information, which is personal and sensitive in nature must be addressed 
| adequately. 


3. It is mentioned that there is lack of a dedicated and comprehensive 
legislation/regulation catering to the privacy, security and confidentiality of health 
data/information. Though there are a number of legislations put in place but these are 
specific only to particular health conditions/circumstances such as for mental/physical 
illness, disability, communicable diseases etc. It is observed that the existing 
legislations in health domain cover some aspects of privacy & security specific only to 
the mandated/limited scope. As a result, an individual may face difficulty in getting 
recourse on a model of “single-window concept” in case of any breach of his/her health 
| data/information. 


4 For electronic data, the Information Technology Act, 2000 provides legal 
recognition to any transaction, which is done by electronic way or use of Internet. The 
issue of data protection (to a limited extent for health sector) has been addressed in 
Information Technology Amendment Act, 2008. It protects in general private 
information that is obtained by agencies by virtue of powers conferred under the Act. 


3. As, the importance for placing a pertinent value on protecting the privacy, 
confidentiality, and security of citizens’ health data and information had been delineated 
in the past at different platforms by stakeholder groups, the Legal Sub-group of EHR 
Standards Committee of MoHFW reviewed the prevailing situation. It was brought out 

| by the Legal Sub-group that a number of pertinent aspects such as consent for data 
collection, purpose limitation, access to data, correction, other rights to data owner, 
norms/guidelines for data — sharing/exchange, provisions of — exact 
penalty/offences/liability & remedy, security etc. are lacking under the existing 
legislations. 


6. The need for statute specifically covering data privacy & security aspects in a 

comprehensive manner in Health Sector emerges more imperative in the context of 

promotion & adoption of e-Health on a large scale through establishment of pan-India 

Integrated Health Information System and EHR System including setting up of Health 
Information Exchanges under Digital India Programme. 


7. In order to address the needs identified & delineated for regulation, data privacy & 
security etc. in Indian eHealth ecosystem so as to achieve an orderly development and 
to gain effective & efficient results thereof, MoHFW decided to set up a nodal body in 
form of an “Authority” through an Act of parliament. Accordingly, a concept note in 
| this regard was drafted by the Legal Sub-group under EHR Standards Commities of 
| MoHFW and was consulted thoroughly with different stakeholders. Thereafter wi 

approval of Hon’ble HFM, the concept note was put in public domain for soliciting 
suggestions/comments from general public. A national level consultation was also held 
on 4" mae 2016 to discuss the concept note and thereafter it was finalised for further 
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Note Np- #T Further, Ministry has given assurances in Parliamer t in respect of two Lok | 
Sabha Unstarred questions No. 5250 dated 24.04.2015 and No. 1639 25.11.2016. The ¢ 
Current status furnished to the Committee on Governmént Assurances is as below(F/X);: e 


(i) LOK SABHA USQ No.5250: 


“A concept note of NeHA was prepared and National consultation was held on 4" 
April, 2016; Establishment of National e-Health Authority (NeHA) is clubbed with 
Health Data Privacy & Security Act. Recently, a draft of legislation prepared by 
National Law School of India University (NLSIU), Bengaluru has been discussed on 
24" March 2017. Key suggestions made by participants and legal experts have been 
noted and the draft is being revised accordingly. ” 


(ii) LOK SABHA USQ No. 1639: 


“The work of drafting the proposed legislation for Health Data Privacy & Security 
Act, was awarded to National Law School of India University (NLSIU), Bengaluru. I“ 
draft of the legislation was prepared by NLSIU & submitted to MoHFW. "4 Draft of | 
the legislation is ready and is under discussion. ” 


Recently AS(H) has taken a review meeting on 18" May, 2017 to review the assurance 


of the Ministry. He has directed all the divisions to fulfil all the assurances at the 
earliest. 


9. For drafting the Act for setting up the envisaged Authority, MoHFW mandated 
the task to National Law School of India University (NLSIU), Bengaluru in Feb, 2016. 
The draft Act for setting up the Central Authority by name “National Digital Health 
Authority of India (NDHAI)” has now been finalised after a number of rounds of | 
discussions & deliberations with various stakeholders over the past few months. The | 
stakeholders consulted for this purpose were drawn from divergent groups such as 

health service provider, medical professional, health informatics professional, industry 


association, legal experts etc. and other Ministries/Departments/Organisations such 
MeitY, UIDAT etc. | 





10. The key sections of the draft Act are regarding: 
- Confidentiality, privacy, ownership of health data | 
« Rights to health data owner (i.e. Patient) 
= Norms to be followed by health services providers/heath 
information exchanges in regard to data privacy & security 
- Establishment of National Digital Health Authority of India, its roles & 
power 
- Recognition of Health Information Exchanges (HIEs) by NDHAI | 
- Operational guidelines and mandatory key manning for HIEs 
- Standardization, storage & transmission of data (rules to be formulated 
later by NDHAIJ) 
- _ Nature of punishment (civil or criminal depending on case) etc., for data 
breach 
- Setting up of Adjudicating Authority(ies) 
o To penalise for data privacy & security breach 
- Setting up of Appellate Tribunal 





} 
A brief note highlighting salient features of the Draft Act is placed at F/A. 


Il. It may also be noted that the National Health Policy (NHP) 2017 (copy 
enclosed at F/B) having recognised the integral role of technology (eHealth, mHealth, 
Cloud, Internet of things, wearables, etc.) in the healthcare delivery, also outlines 
setting up a National Digital Health Authority (NDHA) to regulate, develop and deploy 
digital health across the continuum of care. The Policy aims at an integrated health 
information system which serves the needs of all stake-holders and improves efficiency, 
transparency, and citizen experience. Therefore significance and role of NDHA emerges 
quite imperative and critical for overall development of Indian eHealth ecosystem in an 
orderly manner. 
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Subject: Approval of Draft Act for setting up of “National Digital Health 
Authority of India (NDHAT)” —reg 


was proposed to put the Draft Act in public domain by 31“ May 2017, for a period of at 
least one month for soliciting suggestions/comments from general public. Thereafter the 
suggestions/comments received would be analysed and appropriately addressed through 
modifications, as required, in the Draft Act. Further the work for preparation of Bill in 
coordination with Ministry of Law will be undertaken. 


gi 
12. In the meeting held on 24™ March 2017 under the chairmanship of AS&DG it (F/ c) 


| Hon’ble MoS (AP) taken a review meeting of eHealth on 15.05.2017 and directed that 
the deadline for 31.05.17 to put the Draft Act in public domain by 31° May 2017, 
should be adhered. 


Accordingly, approval of Hon’ble HFM is solicited for putting the “Draft Act 


for setting up of NDHAIT” in public domain. 
Ep 
(Jitendra Arora 


Director (eHealth) 


a gg —- 


aol 
23/51) 
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F.No.Q.11013/6/2015-eGov 


(FTS No.3035352) 


Ref. notings from p.9/n regarding setting up of National Digital Health 


Authority of India. 
2. Secretary (H&FW) may please discuss the issue with me. 
ae, Prakash Nadda) 
Union Minister of Health & F.W. 
June Zz , 2017 
Secretary ) 
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29/09/2017 2:53 PM 
AMIT KUMAR-AD 
(AD) 


Note No. #3 


Subject: Approval of Draft Act for “Digital Healthcare Data Privacy, 
Confidentiality & Security” —-reg 


Reference note from page 9-12/ ante regarding the Draft Act prepared by Ministry 
of Health & Family Welfare (MoHFW) for addressing and ensuring privacy, confidentiality 
and security of digital healthcare data by setting up of an institutional framework (consisting 
of National Digital Health Authority of India- NDHA, Adyjudicating Authorities etc.), 
regulations & rules etc. and putting it in public domain for inviting comments. 


2. It is submitted that, in Health Sector, both public and private sectors, a number of 
Digital Health Systems have currently been implemented which collect and collate 
health/clinical data of patients/citizens on a large and diversified scale. As a result huge 
health/clinical data repositories are being created and made use of. More number of such 
health information systems continue to be developed and implemented adding to the volume 
of health data repositories on a continuous basis. Also the use/transfer/transactions of health 
data, especially in electronic format, 1s continually increasing. Under such a scenario, privacy, 
confidentiality and security of health data/information, which is personal and sensitive in 
nature must be addressed adequately. 


3. It is mentioned that at present there 1s no dedicated and comprehensive legislation/ 
regulation specially catering to the privacy, security and confidentiality of sensitive health 
data/information. Though there are a number of legislations put in place but these are specific 
only to particular health conditions/circumstances such as for mental/physical illness, 
disability, communicable diseases etc. It 1s observed that the existing legislations in health 
domain cover some aspects of privacy & security specific only to the mandated/limited scope. 
As a result, an individual may face difficulty in getting recourse on a model of “single- 
window concept” in case of any breach of his/her health data/information. 


4. The need for statute specifically covering data privacy & security aspects in a 
comprehensive manner in Health Sector emerges more imperative in the context of 
promotion & adoption of Digital Health on a large scale through establishment of pan- 
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India Integrated Health Information System and Electronic Health Record (EHR) 
System including setting up of Health Information Exchanges (for transmission and 
sharing of EHRs of citizens) under Digital India Programme. 


>: In order to address the needs identified & delineated for regulation, data privacy & 
security etc. in Indian Digital Health ecosystem so as to achieve an orderly development and 
to gain effective & efficient results thereof, MoHFW planned to set up a nodal body in form 
of an “Authority” through an Act of parliament. Accordingly, a concept note in this regard 
was drafted and was consulted thoroughly with different stakeholders. Thereafter with 
approval of Hon’ble HFM, the concept note was put in public domain for soliciting 
suggestions/comments from general public. A national level consultation was also held on 4th 
April 2016 to discuss the concept note and thereafter it was finalized for further perusal. 


6. Further, Ministry has given assurances in Parliament in respect of two Lok-Sabha 
Unstarred questions No. 5250 dated 24.04.2015 and No. 1639 dated 25.11.2016 for bringing 
in Act for setting up of NDHA for Digital Healthcare Data Privacy, Confidentiality & 
Security. Accordingly Ministry started working on preparation of a comprehensive draft 
legislation in this direction to explicitly render protection to an individual in terms of privacy, 
confidentiality and security covering the key aspects such as ‘ownership’ of ‘digital health 
data’, ‘health data standardization in collection, storage, exchange’ and ‘framework to provide 
civil and criminal remedies for data breach’. 


7. For drafting the Act, MoHFW mandated the task to National Law School of India 
University (NLSIU), Bengaluru in Feb, 2016. After discussions & deliberations with MoHFW 
and various stakeholders and taking inputs from them, NLSIU prepared and submitted the 
draft (i.e. NDHAI Act) accordingly _vide letter dated 15.09.2017 based upon the last 
discussion held in MoHFW. The draft submitted by NLSIU proposes setting up of Digital 
Health Authority at central level only 1.e. NDHAI. 


8. Thereafter, MoHFW had further deliberations with National Health Systems Resource 
Centre (NHSRC) and also Legislative department (Ministry of Law) on the draft Act 
submitted by NLSIU. During the deliberations, in view of the administrative and 
constitutional issues involved it was suggested that the proposed institutional framework set- 
up should also have state-level digital health authorities in addition to national level digital 
health authority for ensuring engagement of the states on this critical issue of health data 
privacy & security and better addressal of digital health standardizations across health service 
providers and health information exchanges. Accordingly the draft submitted by NLSIU has 
been modified. The modified draft is placed on file. The key sections of the draft Act (i.e. 
Digital Healthcare Data Privacy, Confidentiality & Security Act) are regarding: 
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© Confidentiality, privacy, ownership of health data- rights to health data owner (1.e. 
Patient); Norms to be followed by health services providers/heath information 
exchanges in regard to data privacy & security 

G Establishment of National Digital Health Authority of India (NDHA) and State Digital 
Health Authorities (SDHA), their organisational structures, roles & power 

© Setting up of Health Information Exchange(s) (HIEs) by central government 

© Operational guidelines and mandatory key manning for HIEs 

© Standardization, storage & transmission of data (rules to be formulated later by NDHA 
& SDHA) 

G Nature of punishment (civil or criminal depending on case) etc., for data breach 

oO Setting up of Adjudicating Authority(ies) at State levels- To address complaints of 
data breach against a clinical establishment or any & penalise accordingly 

G Setting up of Adjudicating Authority at Central - To address complaints of data breach 
against a health information exchange or State Digital Health Authority or the 
National Digital Health Authority & penalise accordingly 


A brief note highlighting salient features of the Draft Act ts placed at_F/A. 


8. In this context, 1t is mentioned that the file seeking approval of Hon’ble HFM for putting 
the Draft Act in public domain was submitted on 22.5.2017. However, it was decided that this 
issue may be brought up when a presentation on all aspects of health IT interventions 1s made 
(Page 12/n). During the review held under the chairmanship of Hon’ble HFM on 19.08.17 the 
draft Act was discussed and Hon’ble HFM desired that the matter should also be discussed 
with Ministry of Electronics & Information Technology (MeitY) to find out whether an 
independent Act for Health Department is required or it shall be subsumed within the Act 
being prepared by the MeitY. 





9. In this regard , it is stated that the data protection act is being drafted by MeitY in 
consultation with UIDAI with reference to the development of a landmark Judgment passed 
by Hon’ble Supreme court on Aadhar Act on (2017, August-24 ). However, this data 
protection act is currently at the conceptual level and consultations are currently being 
organized to identify “key data protection issues” and to suggest a draft data protection Bill 
accordingly. The need to have an independent Act for Health Domain has therefore been 
examined as advised by Hon’ble HFM and based on the examination, it is mentioned that: 


i. There are two global approaches to protect individual right of privacy viz., (1) through 
a legislation which would be overarching all aspects of privacy. UK’s data protection 
Act or some countries that have an explicit provision of privacy included in to their 
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constitution are good instances of this approach; (11) by having a sectoral specific law - 

which would address sector specific issues. Jn India universal formulation was 

attempted by inserting provisions in Information and Technology Act, which are not 
felt to be sufficient to protect individual privacy to the desired level. Therefore 

Aadhaar legislation, further addresses the issue separately. 

Health data is globally accepted to be a ’sensitive data’ which deserves to be protected 

more than other forms of “personal data’. Therefore the contention is to have a 

dedicated/specialized legal framework. 

i. Nonetheless, a health sector focused Act is imperative given the typical nature of 
operational issues involved given “care-provider” centric model of delivery. In health 
sector violation of privacy involving highly sensitive data can take place in a number 
of areas like unnecessary collection of data, purpose of collecting data not specified, 
refusal to provide records upon request by client, disclosure of information without 
consent, inadequate notification to a patient of a data breach, use for public health 
analysis etc. Therefore patients must feel at ease while sharing private & health 
information and medical history when availing healthcare services. 


pmmd 0 


il. 


10. —‘It is also submitted that , recognizing the integral role of technology 1.e. eHealth, 
mHealth, cloud, Internet of things IOT, wearables etc. in the health care delivery , the 
National Health Policy 2017 also advocates setting up of a National Digital Health 
Authority (NDHA) to regulate, develop and deploy digital health across the continuum of 
care, which is approved by Cabinet. 


Ll. In view of above, it 1s submitted that the requirement of protecting digital data privacy 
& security aspects in a comprehensive manner in Health sector can be fulfilled only by a 
statute specifically dedicated to health sector. Hence an independent Act for data privacy & 
security in digital Health Domain 1s still required to be perused despite a data protection act 
would be co-exist. Therefore the present draft legislation being piloted by MoHFW, which 
would not conflict or overlap any attempt (in whichever stage) by the MeitY. 


12. As per the process, the Draft Act on Digital Healthcare Data Privacy, Confidentiality 
& Security is to be put in public domain (for a period of at least one month) and to be shared 
with States/UTs for soliciting suggestions/comments. Also public consultation will be held. 
Thereafter, the suggestions/comments received would be analyzed and appropriately 
addressed through modifications/ changes, as required, in the Draft Act and also would be 
aligned with the overall national level data privacy framework being draft by MeitY. After 
finalization of the Act, the work for preparation of Bill in coordination with Ministry of Law 
will be undertaken. 


A copy of the modified draft act is placed on file and may be seen at pg.251/c 
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Accordingly, approval of Hon’ble HFM is solicited for putting the “Draft Act for Digital 
Healthcare Data Privacy, Confidentiality & Security” in public domain. 





Bagi lly Signed | 


29/09/2017 6:36 PM 


JITENDRA ARORA 
(DIR) 


Note No. #4 





03/10/2017 2:42 PM 


JITENDRA ARORA 
(DIR) 


Note No. #5 





04/10/2017 12:31 PM 
R K VATS 
(AS AND DG) 


Note No. #6 


HFM may like to take a presentation on this. 





By gi ally Signed | 


C K MISHRA 
(SECRETARY) 


07/10/2017 5:52 PM 
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Note No. #7 


As advised by Hon’ble HFM, the undermentioned discussed this matter with JS 
(LA) today (2.11.2017). It is requested that this issue may be processed as per 
the discussion and submitted for consideration of Hon’ ble HFM. 


(Ritesh Chauhan) 
PS to Hon’ble HFM 


JS (LA) 


02/11/2017 6:28 PM 
JAGAT PRAKASH NADDA(HFM) 
(HFM) 


Note No. #8 





04/11/2017 11:09 AM 


LAV AGARWAL 
(JS) 


Note No. #9 


Reference above : 


As discussed, a table, showing the suggestions given by PS to HFM office (on the 
draft put up) along with the remarks/ observations ( brief comments) of the 
division has been prepared and placed on file (pg.282 /c) 


The revised draft Act on “Digital Information Security in Healthcare, Act 
(DISHA)” incorporating above suggestions is placed on file at pg.288/c. 


Accordingly, approval of Hon’ble HFM is solicited for putting the Draft Act in 
public domain. 
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Bagi lly Signed| 


JITENDRA ARORA 
(DIR) 


22/11/2017 5:48 PM 


Note No. #10 


As per the discussion with PS to Hon HFM , certain suggestions/modifications have 
been incorporated in the draft Act. The proposed Act is accordingly recirculated. 

It is submitted that the same may be examined and Act put up in public domain 
for comments. 

New suggestions as and when obtained after putting the Act in public domain will 
help refine the draft further. 

There is already a Parliament Assurance on the subject and we may need to 
initiate required necessary steps wrt finalisation of Act. 

It will ensure providing required framework for implementing Electronic Health 
Standards n the country. 

May be approved at Hon HFM level. 





24/11/2017 4:56 PM 
LAV AGARWAL 
(JS) 


Note No. #11 


During discussion on e-Pharmacy , Secy. desired that formal consultation should be 
held with MHA , MieTy as they are dealing with general issues of privacy and cyber 
security. Same holds here also. 





11/12/2017 12:31 PM 


R K VATS 
(AS AND DG) 


Note No. #12 


Let us write to concerned Ministry for their comments as directed by AS & DG. 





15/12/2017 11:58 AM 
LAV AGARWAL 
(JS) 
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Note No. #13 


Draft letter to Miety and MHA is attached for approval and signature please. 


21/12/2017 10:28 AM 


Note No. #14 


21/12/2017 11:20 AM 


Note No. #15 


22/12/2017 10:54 AM 


Note No. #16 


25/12/2017 8:01 AM 


Note No. #17 


Reference- note above. 


S C RAJEEV 
(DIR) 





LAV AGARWAL 
(JS) 


D JEEVARAJ 
(PPS) 


S C RAJEEV 
(DIR) 


D.O letters were sent to Secretary, MHA and Secretary, MeitY seeking 
comments and suggestions on the draft act of these two Ministries before putting 
up the same in public domain for feedback. Since comments/suggestions have 
not been received from these two Ministries, it is proposed to send a reminder as 


per draft(DFA/3156950) put up for approval please. 


03/01/2018 5:26 PM 
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Note No. #18 


03/01/2018 6:02 PM 


Note No. #19 


04/01/2018 3:16 PM 


Note No. #20 


08/01/2018 3:46 PM 


Note No. #21 


09/01/2018 9:36 AM 


Note No. #22 


09/01/2018 9:48 AM 


Generated from eOffice by AMITA VAID, SO, DOHFW DEPARTMENT on 02/12/20 03:12 PM 


3105692 ) 


S K PANI 
(US) 


S C RAJEEV 
(DIR) 





BI ai tally Signed| 


LAV AGARWAL 
(JS) 


D JEEVARAJ 
(PPS) 


S C RAJEEV 
(DIR) 





Bai ally Signed | 


S K PANI 
(US) 
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Note No. #23 


16/01/2018 10:02 AM 


Note No. #24 


16/01/2018 4:37 PM 


Note No. #25 


19/01/2018 3:36 PM 


Note No. #26 


19/01/2018 3:46 PM 


Note No. #27 


3105602 ) 23 


AMIT KUMAR-DD 
(DY.DIR) 


~~ 


HUNNY WADHWA 
(ASO) 


AMIT KUMAR-DD 
(DY.DIR) 


HUNNY WADHWA 
(ASO) 


Subject: Approval of Draft “Digital Information Security tn Healthcare, Act 
(DISHA)” for putting it in public domain for inviting comments-reg 


This is regarding putting up the Draft “Digital Information Security in 


Healthcare, Act (DISHA)” in public domain for comments. 
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Earlier, the file was submitted for approval of Hon’ble HFM for putting the 
draft act in public domain for inviting comments. On this, Secreatry(HFW) directed 
that “formal consultation should be held with MHA and MeityY as they are dealing with 
general issues of privacy and cyber security”. 


Ministry has sent the draft act to MHA and MeitY vide D.O. letter dated 21st 
December, 2017 and vide subsequent reminder letter dated 16th January, 2018 
requesting their comments / suggestions on the draft act. So far, no communication 
has been received from MHA and MeitY in this regard. 





It is therefore proposed that file may be submitted for seeking approval of 
Hon’ble HFM for putting the draft act in public domain for inviting comments. New 
Suggestions as and when obtained after putting the Act in public domain will help 
refine the draft further. 





09/02/2018 3:00 PM 
AMIT KUMAR-DD 
(DY.DIR) 


Note No. #28 


In reference to above it is to submit that comments of MHA has been received 
and place at page 360 in correspondence.The same may be perused pl. The 
comments of Meity are yet to be received . A reminder have also been sent. It is 
therefore proposed that file may be submitted for seeking approval of Hon’ble 
HFM for putting the draft act in public domain for inviting comments . The 
Suggestions of public and comments of MHA , Meity and other related 
ministry/dept will be incorporated accordingly. 


12/02/2018 7:40 PM 
S C RAJEEV 
(DIR) 


Note No. #29 


The draft Act has been made in consultation with National law School , Bangalore 
and NHSRC duly involving subject experts also. 

This issue was discussed in Secy H meeting with Secy IT wherein it was decided that 
while Meity will come with an overarching Act on data privacy , Ministries like Health 
need to come up with their separate Acts on Digital Health data issues. Certain 
comments as obtained through PS to HFM have already been incorporated in the 
draft also. 

As was earlier endorsed by AS & DG, we had written to MHA and Meity and response 
after regular follow up has only come from MHA. Their comments can be 
incorporated as part of updation after obtaining public comments on the issue. 
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Present proposal is also part of our Assurance and is already badly delayed. 
Permission may be given to put up the draft in Public domain for obtaining comments 
as part of wider consultation. 

approval at Hon HFM level may be given pl. 





14/02/2018 2:21 PM 


LAV AGARWAL 
(JS) 


Note No. #30 





22/02/2018 4:27 PM 


R K VATS 
(AS AND DG) 


Note No. #31 


agi fitally Signed| 


PREETI SUDAN 
(SECRETARY) 


22/02/2018 7:05 PM 


Note No. #32 





24/02/2018 11:32 AM 


R K VATS 
(AS AND DG) 


Note No. #33 





26/02/2018 8:34 PM 
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Note No. #34 


01/03/2018 10:38 AM 


Note No. #35 


06/03/2018 4:56 PM 


Note No. #36 


06/03/2018 5:18 PM 


Note No. #37 


08/03/2018 8:33 PM 


Note No. #38 
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(MOS) 





JAGAT PRAKASH NADDA(HFM) 
(HFM) 


Bic lly Signed | 


ANUPRIYA SINGH PATEL 
(MOS) 





PREETI SUDAN 
(SECRETARY) 


agi lly Signed | 


R K VATS 
(AS AND DG) 
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11/03/2018 11:08 AM 


Note No. #39 


13/03/2018 9:37 AM 


Note No. #40 


13/03/2018 10:37 AM 


Note No. #41 


Reference Notes above: 


3105692 ) 





LAV AGARWAL 
(JS) 


S C RAJEEV 
(DIR) 


AMIT KUMAR-DD 
(DY.DIR) 


Hon'ble HFM has approved for placing the draft “Digital Information Security 
in Healthcare, Act (DISHA)” in public domain for comments. In this regard, two 


drafts has been prepared for the following: 


1. Notice for placing the draft act on Ministry's Website for public comments. 


2. ADO letter to Principal Secretaries of all States/UTs and to all JSs in the 


Ministry for their comments. 


For approval Please 


15/03/2018 5:05 PM 


Note No. #42 
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15/03/2018 5:32 PM 
AMIT KUMAR-DD 


(DY.DIR) 
Note No. #43 
for approval of draft and signature of letter at sr. No 2 above please. 
18/03/2018 2:19 PM 
S C RAJEEV 
(DIR) 


Note No. #44 





LAV AGARWAL 


19/03/2018 9:56 PM 


(JS) 
Note No. #45 
20/03/2018 5:17 PM 
S C RAJEEV 
(DIR) 


Note No. #46 
draft act has been put up in public domain at ministry's website on 21.03.2018. 


Letters have been sent to all the states for comments. pls upload o/c. 


05/04/2018 12:17 PM 
AMIT KUMAR-DD 
(DY.DIR) 


Note No. #47 
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11/05/2018 4:53 PM 
HUNNY WADHWA 
(ASO) 


Note No. #48 


18/05/2018 5:19 PM 
AMIT KUMAR-DD 
(DY.DIR) 


Note No. #49 


This is regarding the Draft Act prepared by Ministry of Health & Family Welfare 
(MoHFW) for setting up of “Digital Information Security in Healthcare, Act 
(DISHA)” to regulate, develop standards and strategize & deploy digital health 
across the continuum of care. 


2: The draft “Digital Information Security in Healthcare, Act (DISHA)” has 
been made in consultation with National Law School, Bangalore and NHSRC 
involving subject experts. Hon'ble HFM has approved for placing the draft in public 
domain for comments. The draft act was put in public domain at Ministry's website on 
21.03.2018 for a period of one month. 


3. It is also informed that the letters were also sent to the Principal Secretaries 
of all the States/UTs for their comments. States/ UTs have not sent any 


inputs/comments on this act till date. 


4. Further, Ministry has sent the draft act to MHA and MeitY vide D.O. letter 
dated 21st December, 2017 and subsequent reminder letter dated 16th January, 
2018 requesting their comments / suggestions on the draft act. So far, no 
communication has been received from MHA and MeitY in this regard. 





, So far, 70 comments / suggestions have been received from different 
organizations/individuals through emails and by post. The comments/suggestions 
received from various these organizations/individuals have been compiled and 
examined by eHealth Team. The compiled comments along with action point/remarks 


may be seen at p.368-490/cor. 
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6. However, to incorporate the received suggestions in the draft act 
appropriately, it is proposed that a committee with legal experts, healthcare -IT 
experts, doctors, etc may be constituted for following activities: 


i. to examine the comments for its legal validity 
il. to check whether the suggestions are aligned with the objective of the draft act 
lll. to incorporate the suggestions in the appropriate sections of the draft act 


Bl ai ily Signed | 


S K PANI 
(US) 


Submitted for consideration and further orders please. 





18/05/2018 5:38 PM 


Note No. #50 


In reference of above it is to mentioned that as per para 7 of of MOM dated 15/1/18 held 
under co chairmanship of Secy (H) and Secy(IT) copy attached below, "Secretary 
MeitY appraised that his Ministry has come-up with Data Protection Act which is currently 
placed in public domain and would create baseline for protection of citizen data. However, 
he also informed that domain specific specialized regulations or act would come from 
concerned ministries and suggested that Digital Health Data Privacy Act developed by 
MOoHFW may be shared with MeitY for alignment with the provisions of Data Protection Act". 


In this respect , Ministry has sent the draft act to MHA and MeitY vide D.O. letter dated 
21st December, 2017 and subsequent reminder letter dated 16th January, 2018 
requesting their comments / suggestions on the draft act. The comments has been 
received from MeitY in this regard, vide letter dated 17/5/2018, copy placed at page 491- 
495. 


In above respect it is to mentioned that recently MeitY has also drafted “White 
paper on Data protection framework in India”. The undersigned was asked to 
examine this framework thoroughly to find out whether an independent Act for 
Health Department is required or it shall be absorbed within the Act being prepared 
by the MeitY to avoid multiple act on similar issues. In this respect it is to mentioned 
that the ‘Substantive Part’ of DISHA act broadly covers the followings aspect: 


- Confidentiality, privacy, ownership of health data 

- Issue of standardization, storage, transmission of data & 
Health Information Exchange 

¢ Establishment of Regulatory Bodies as National eHealth 
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Authority (NeHA) at national level & State eHealth Authority 
(SeHA) at State level, its roles and power 

- Nature of punishment (civil or criminal) etc., for data breach 

- Setting up of Adjudicating Authority & Appellate Tribunal 


While going through the drafted “White paper on Data protection framework of Meity, it is 
observed that White paper on Data Protection in India developed by MeitY has broadly 
covered all aspect of the Data Privacy, security and protection in general and in principle 
the need for having separate Data protection act for Health need to be looked into. 


4. Further, MOHFW emphases on building inter-operability amongst various Health IT 
Systems to achieve a uniform standard-based system for creation and maintenance of 
Electronic Health Records (EHRs) of citizens. However to fulfill this alignment of DISHA and 
proposed Data Protection framework developed by MeitY is essential and must be ensured. 


As directed a DFA from Secy(H) to Secy(IT) is also prepared and is placed for approval 
please. 


W MoM held on 15 January 2018-sect H -Secy IT.pdf 


28/05/2018 7:05 PM 
S C RAJEEV 
(DIR) 


Note No. #51 


Draft DO letter may be approved pl. 





31/05/2018 9:52 AM 


LAV AGARWAL 
(JS) 


Note No. #52 


W 3105692.pdf 


01/06/2018 11:39 AM 
SANJEEVA KUMAR 
(AS) 


Note No. #53 


Kindly see the endorsement of Incharge Secy H wherein it was directed to put the 
file to Secy H after return from leave. 
For favour of approval accordingly pl. 
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01/06/2018 11:57 AM 


Note No. #54 


04/06/2018 10:59 AM 


Note No. #55 


04/06/2018 11:52 AM 


Note No. #56 


05/06/2018 11:25 AM 


Note No. #57 


05/06/2018 11:31 AM 


Note No. #58 
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Bagi tally Signed| 


LAV AGARWAL 
(JS) 


PREETI SUDAN 
(SECRETARY) 


A HARIDAS 
(PPS) 


B NEELA MOHANA RAO 
(PERSONAL ASSISTANT) 





LAV AGARWAL 
(JS) 
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05/06/2018 6:55 PM 
S C RAJEEV 
(DIR) 


Note No. #59 





06/06/2018 9:52 AM 


S K PANI 
(US) 


Note No. #60 


Response from MeitY has been received , pls put up. 


20/08/2018 3:51 PM 
AMIT KUMAR-DD 
(DY.DIR) 


Note No. #61 


PUC is a communication received from Shri Ajay Sawhney, Secretary, 
MeitY referring to the D.O. letter dated O4th June 2018 from Secretary (H) 
requesting MeitY to examine the draft DISHA legislation and advise whether 
Ministry of Health need to come up with a separate Act on Digital Health or that 
MeitY shall come up with a comprehensive Data Protection Framework offering 
domain specific flexibility to define their own standards in proposed framework to 
avoid multiple data protection legislation. 


2. Shri Sawhney has apprised that with the objective to ensure growth of 
the digital economy while keeping personal data of citizens secure and protected, 
a Committee of Experts on Data Protection has been constituted under the 
Chairmanship of Justice B.N. Krishna, Former Judge, Supreme Court of India. 
The committee comprises of members from Government, Academia and 
Industry, with the aim of studying and identifying key data protection issues and 
recommending methods for addressing them. 


3; It is also mentioned in the PUC that the committee released a white 
paper on 27th November 2017 to solicit public comments on what shape a data 
protection law could take. With respect to the comments received, committee is 
presently at an advanced stage of finalization of its report. The committee has 
been requested to submit a report on "Data Protection Framework" as 
expeditiously as possible. 


4, With respect to concerns regarding overlap between DISHA and the 
proposed framework, Shri Sawhney has informed that draft Data Protection 
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Framework includes clear role for Sectoral Regulators who will be 
involved in sector specific guidelines and codes of practice. 


ae File is submitted for information and further guidance on this matter. 


21/08/2018 2:58 PM 


ASHISH SHARMA-II(EGOV) 
(ASO) 


Note No. #62 





21/08/2018 3:46 PM 
AMIT KUMAR-DD 


(DY.DIR) 
Note No. #63 
23/08/2018 10:17 AM 
S C RAJEEV 
(DIR) 


Note No. #64 


Comments from MEITY are submitted for perusal and further n/a pl. 





26/08/2018 9:59 AM 


LAV AGARWAL 
(JS) 


Note No. #65 





27/08/2018 7:13 PM 
SANJEEVA KUMAR 
(AS) 


Note No. #66 
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Comments from Meity may be seen. As per above , we may have till Data 
Protection Framework is finalized by MEITY and role of sectors is delineated 


properly. 
We may address MEITY accordingly for further course of action. 


31/08/2018 2:26 PM 


Note No. #67 


07/09/2018 5:42 PM 


Note No. #68 


10/09/2018 5:55 PM 


Note No. #69 


10/09/2018 5:56 PM 


Note No. #70 


Pl. put up draft accordingly. 


10/09/2018 6:21 PM 
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By agi lly Signed | 


LAV AGARWAL 
(JS) 





SANJEEVA KUMAR 
(AS) 


PREETI SUDAN 
(SECRETARY) 








SANJEEVA KUMAR 
(AS) 





Bagi ; lly Signed| 


LAV AGARWAL 
(JS) 
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Note No. #71 


14/09/2018 12:19 PM 
S C RAJEEV 
(DIR) 


Note No. #72 





14/09/2018 12:34 PM 


S K PANI 
(US) 


Note No. #73 


A draft letter has been prepared and is placed for approval please. 


14/09/2018 5:17 PM 
ASHISH SHARMA-II(EGOV) 
(ASO) 


Note No. #74 


As directed by JS(eHealth), a draft has been put up informing MeitY that Ministry 
of Health and Family Welfare shall put DISHA on hold till the notification of Data 
Protection Framework by MeitY. The role of Ministry of Health and Family 
Welfare, as laid under the Data Protection Framework, will be taken up after the 
notification to avoid any contradiction. 


For approval please. 





17/09/2018 10:58 AM 
AMIT KUMAR-DD 
(DY.DIR) 


Note No. #75 
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18/09/2018 6:57 PM 


Note No. #76 


pl. discuss draft. 


21/09/2018 6:31 AM 


Note No. #77 


PI modify dfa as discussed. 


03/10/2018 5:28 PM 


Note No. #78 


3105692 ) 


S C RAJEEV 
(DIR) 


By agi lly Signed | 


LAV AGARWAL 
(JS) 


S C RAJEEV 
(DIR) 


As discussed, the Draft has been revised and submitted pls. 


04/10/2018 11:11 AM 


Note No. #79 


08/10/2018 1:17 PM 


Note No. #80 


11/10/2018 2:06 PM 
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Note No. #81 


D.O. Letter has been signed and sent for issue. 


17/10/2018 4:54 PM 


Note No. #82 


25/10/2018 1:50 PM 


Note No. #83 


25/10/2018 2:11 PM 


Note No. #84 


pls attached the letter signed by JS in the file. 


29/10/2018 12:58 PM 


Note No. #85 


29/10/2018 3:46 PM 


Note No. #86 


Generated from eOffice by AMITA VAID, SO, DOHFW DEPARTMENT on 02/12/20 03:12 PM 


D JEEVARAJ 
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S C RAJEEV 
(DIR) 





S K PANI 
(US) 


AMIT KUMAR-DD 
(DY.DIR) 


CHARU KHATTER 
(EXECUTIVE ASSTT) 
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06/12/2018 11:54 AM 


ASHISH SHARMA-II(EGOV) 


Note No. #87 


17/12/2018 4:49 PM 


Note No. #88 


06/02/2019 4:38 PM 


(ASO) 


HUNNY WADHWA 
(ASO) 


ASHISH SHARMA-II(EGOV) 


Note No. #89 


File discussed with AS(H) w.r.t. Cabinet Note being prepared. 


07/02/2019 7:01 PM 


Note No. #90 


26/03/2019 10:09 AM 


(ASO) 


Bai ally Signed| 


SACHIN MITTAL 
(DIR) 


ASHISH SHARMA-II(EGOV) 


Note No. #91 


28/03/2019 2:31 PM 
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Note No. #92 


28/03/2019 2:54 PM 


Note No. #93 


24/04/2019 3:53 PM 


Note No. #94 


12/07/2019 10:31 AM 


Note No. #95 


23/07/2019 1:38 PM 


Note No. #96 


ASHISH SHARMA-II(EGOV) 
(ASO) 


HUNNY WADHWA 
(ASO) 


ASHISH SHARMA-II(EGOV) 
(ASO) 


HUNNY WADHWA 
(ASO) 


A D.O. letter from JS (eHealth) was sent to Secretary (MeitY) submitting that the 
report of the committee under the chairmanship of Justice B.N. Srikrishna, 
Former Judge Supreme Court of India has been submitted to MeitY and MeitY 
may outline the clear role of Ministry of Health and Family Welfare in respect of 
Data Protection Framework and for further directions, if any, on the draft of 
Digital Information Security in Healthcare Sector (DISHA) as proposed. 


2 No response has been received from MeitY till date. Submitted for 


necessary direction please. 


23/07/2019 3:06 PM 
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Note No. #97 


26/07/2019 5:43 PM 


Note No. #98 


06/10/2020 10:51 AM 


Note No. #99 


20/10/2020 3:55 PM 


Note No. #100 


3105692 ) At 


JOGINDER PAL 
(US) 


HUNNY WADHWA 
(ASO) 


AMITA VAID 
(SO) 


We may propose to send another d.o reminder. Pl put up accordingly with draft 


d.o. letter 


20/10/2020 4:03 PM 
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File No: Z-18015/3/2018-eGov-Part(1} 
Government of India 
Ministry of Health and Family Welfare 
e-Health Section 


Nirman Bhawan, New Delhi 
Dated 30” January, 2018 


Subject: Minutes of the meeting held under the Joint Chairmanship of 


Secretary(HFW) & Secretary (MeitY) on 15 January 2018, in Nirman 
Bhavan, New Delhi. 


The undersigned is directed to enclose herewith the Minutes of the meeting 


held under the Joint Chairmanship of Secretary(HFW) & Secretary (MeitY) on 15" 


January 2018 in Nirman Bhavan, New Delhi for information and necessary action 


Encel.: Minutes of meeting. 
——_—" 


(S.K. Pani) 


Under Secretary to the Government of India 


. Secretary, MeitY, Electronics Niketan, CGO Complex, New Delhi 

. CEO, NeGD, MeitY, Electronics Niketan, CGO Complex, New Delhi 
. Addl. Secy. (Health), MoHFW 

.AS&DG (CGHS), MoHFW 


AS&MD (NHM), MoHFW 


. Joint Secretary(VG), MoHFW 
. Joint Secretary (eHealth), MoHFW 
. Joint Secretary(AS), MOoHFVW 


Director (eHealth) MoHFW 


10. Sr. Technical Director, NIC 
11. Additional Director, CHI, NIHFW, MoHFW 
12. Deputy Director (eHealth), MoHFW 


To, 
1 
2 
3 
4 
5. 
6 
7 
8 
9. 

Copy to:- 


Sr. PPS to Secretary(HFVW), Nirman Bhawan, New Delhi 
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Ministry of Health & Family Welfare (MoHFW) 
eHealth Division 


Government of India 
Ye b k ke e 





Subject: Minutes of meeting held under the Joint Chairmanship of Secretary Health & 
Secretary IT on 15" January 2018, at Room No. 155 A, Nirman Bhavan, New Delhi. 


A meeting regarding IT related issues and Computerization was held on 15" January 
2018 at 5:30PM in Ministry of Health & Family Welfare, New Delhi. The meeting was co- 
chaired by Secretary Health & Family welfare and Secretary MeitY. The list of participants in 
enclosed in annexure-|. 


2. Secretary, Health & Family Welfare Ms. Preeti Sudan welcomed the participants and has 
emphasized that IT has a great role to play in healthcare and Ministry of Health & Family 
Welfare has taken many initiatives in this regard. She, however also pointed out that most of 
these initiatives are in pieces and it 1s difficult to sometime form a bigger picture out of it and 
suggested that MeitY should help MoHFW to integrate these IT systems so that data is made 
available for program and policy management. 


3. Secretary, MeitY, Shri Ajay Prakash Sawhney mentioned that MeitY has come-up with a 
major plan for creating Trillion Dollar digital economy in India and a report in this regard has 
been published which has recommended deeper penetration of IT in many areas including health. 
He suggested that MoHFW can prioritize the areas where IT interventions are required and 
MeitY would provide all required support. He gave examples of larger systems such as MCTS, 
CGHS being created and managed by MeitY and appraised that similar support would continue 
in all major upcoming areas from MeitY to MoHFW. 


4. Joint Secretary (e-Gov), Shri Lav Agarwal made a detailed presentation on the current status 
of IT in healthcare, the challenges faced, determinants of successful nation-wide health 
information programs, proposed vision for e-health architecture and required e-health ecosystem. 
Various issues were discussed during the course of presentation 1.e. current IT infrastructure, lack 
of integration among health IT system, standards creation and compliance, certification of IT 
systems on standards and legal framework for protecting privacy and confidentiality of 
healthcare data. 


5. It was suggested that some states have done better in terms of HIS and Telemedicine 
implementations. These needs to be studied, documented and some of these may be taken-up for 
scale-up. It was also suggested that limited use of Tele-medicine/ Tele-consultation needs to be 
studied and a strategic plan for proper utilization of Tele-medicine services needs to be chalked 


out. 
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6. Use of Hospital Information Systems (HIS) /EHR ( Electronic Health Record) systems by 
states for generation of clinical data was discussed in great details and it was agreed that 
electronic health record of the patient 1s critical for generating population analytics. In this regard 
issues related to procurement of IT systems was brought for discussion and Secretary H&FW 
suggested that MoHFW’s notified EHR standards may be shared with MeitY for identification. 
certification and listing of IT systems which are compliant with these standards. These certified 
systems may be empanelled and listed in GEM for procurement by states and central government 
and the same can be coordinated by Meity. She also mentioned that GEM may also be addressed 
to undertake the listing of softwares which are as per standards on their portal. C-DAC Pune 
which has been entrusted with the task of EHR standards implementation may work with GeM in 
this regard. 


7. Healtheare data privacy and security in addition to use of Aadhaar for tdentification 
purposes in healthcare, methods of data storage, cloud-based models, repositories and exchange 
were also discussed in detail. Secretary MeitY appraised that his ministry has come-up with Data 
Protection Act which is currently placed in public domain and would create baseline for 
protection of citizen data. However, he also informed that domain specific specialized 
regulations or act would come from concerned ministries and suggested that Digital Health Data 
Privacy Act developed by MoHFW may be shared with MeitY for alignment with the provisions 
of Data Protection Act. 


8. Secretary H&FW suggested that MoHFW has some major upcoming programs and some of 
these require robust IT intervention. While working on the issues as identified above, she has 
prioritized following five areas for immediate attention for with respect to use of IT: 


|. Comprehensive Primary Care Services and NCD Screening: A set of services are 
being planned to be rolled-out under comprehensive primary health care strategy of 
MoHFW. Some of the components of this are already computerized such as MCTS/RCT 
Portal and ANMOL and for some other components new software systems are being 
developed such as NCD screening. We need to integrate these so that continuity of care Is 
maintained and longitudinal record for patients is created . She proposed that to begin 
with the program should be launched in 115 Aspirational districts (along with already 
identified districts by NHM) and then same be rolled out pan India and requested Meity 


to coordinate and support the initiative. 


ll. Tele-medicine nodes: She proposed that Meity shall support launching telemedicine 
(including tele diagnostics, teleconsultation) pan India connecting all remote PHCs. To 
begin with these shall be launched in 115 identified Aspirational districts. 


li. e-Learning in Healthcare: MoHFW supports various training programs.Some of these 
are routine trainings however some are specialized training programs. We need to convert 
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most of these into e-learning modules. Swayam Portal of HRD Ministry can be studied 
for this purpose. 


iV. National Health Protection Scheme: Proposed NHPS scheme would require a robust 
application during implementation. She requested Meity to take this as a high priority 
task and help prepare an application for the same duly analyzing the existing application 
which are being used by states presently. It was agreed that MeitY would help MoHkW 
towards identification of suitable software systems for NHPS and MeitY would assign an 
officer at Joint Secretary/Director level to coordinate with MoHFW tn this regard. 


Vv. Dashboard: There is an urgent need to build monitoring dashboard for MoHFW where 
the ministry is able to see the performance of states on various health indicators and can 
rank states or even districts based on their performance. NITI Aayog as well as state of 
Andhra Pradesh are using similar Dashboard and she proposed it accordingly to be 
prioritized. 


It was decided that a detailed plan of action on each of these would be worked out by MeitY 
and shared with Min. of H&FW. 


Meeting ended with vote of thanks to Chair. 


Annexure — | 


—  ———— TT 


S.No | Name a Designation /Org. 7 
1. _| Ms. Preeti Sudan | Secretary H&FW | eas 








Sh. Ajay Prakash Sawhney | Secretary, MeitY 
| CEO, NeGD 


Addl. Secy. (Health) 
AS&DG (CGHS) eee ees 
AS&MD (NHM) ee 


| Joint Secretary 


Joint Secretary (eHealth), MoHFW. 4 
Joint Secretar oe 
Director (eHealth) MoHFW | 
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I Sh. Sunil Kumar Sr. Technical Director, NIC _ 
Sh. Ankit Tripathi Additional Director ,CHI, 
(a Sh SK Pani | Under Secretary(eHealth) 





ea Sh Amit Kumar Deputy Director (eHealth) 


| Sh Amit Mishra , - Consultant. MOHEW 
Sh Gurucharan Sin oh Consultant eHealth, Mo 
a Sh Suresh S. Consultant eHealth, MoHFW 


Sh. Vijay Kumar Consultant eHealth, MoHFW 


Sh. Abhishek Chnadra | Consultant eHealth, MoHEW 


20._| Sh. Himanshu Satija | McKinsey & Company 
2| Ms Ipshita Mandal McKinsey & Company 






















—— 
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» Setting up of Adjudicating Authority & Appellate Tribunal 


While going through the drafted “White paper on Data protection framework of Meity, it is 
observed that White paper on Data Protection in India developed by MeitY has broadly 
covered all aspect of the Data Privacy, security and protection in general and in principle 
the need for having separate Data protection act for Health need to be looked into. 


4. Further, MOHFW emphases on building inter-operability amongst various Health 


IT Systems to achieve a uniform standard-based system for creation and maintenance of 
Electronic Health Records (EHRs) of citizens. However to fulfill this alignment of DISHA 
and proposed Data Protection framework developed by MeityY is essential and must be 
ensured. 


As directed a DFA from Secy(H) to Secy(IT) is also prepared and is placed for approval 
please. 


28/05/2018 7:05 PM 
S C RAJEEV 
(DIR) 
Draft DO letter may be approved pl. 
31/05/2018 9:52 AM 


LAV AGARWAL 
(JS) 


4 Pcasl fer 2) Fed sigtiaiy signed 


for pwd approv-/ — 
ms 


J 
| 


) 


| | | “ so. | 
, tanh 1a) =e \ I freak Sexghaom y Seurekeny 
| _ f 
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V Ma xe a. 
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